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The Examiner has rejected Claims 1, 4, 7, 13, 15, 18. 21, 27, 29, 32, 35, 41, and 45 onder 35 
U,S.C. 102(b) as being anticrpated by Kephart (U.S. Patent No. 5,452,442). Applicant lespectfiiUy 
disagrees with such rejection. 

With respect to the independent claims, the Examiner has relied upon an inherency argument 
with respect to the Kephart reference to make a prior art showmg of applicant's claimed technique 
•^vherein the anti computer virus logic identifies computer viruses prior to identifying the computer 
programs banned firom use" (see this or similar, but not necessarily identical language in the 
independent claims). 

In response, applicant asserts that '*[t]o establish inherency, the extrinsic evidence 'must make 
clear that the missing descriptive matter is necessarily present in the thing described in the reference, 
and that it would be so recognized by persons of ordinary skill. Inherency, however, may not be 
established by probabilities or possibilities. The mere feet that a certain thing may result from a given 
set of circumstances is not sufficient/" In re Robertson, 169 F.3d 743, 745, 49 USPQ2d 1949, 1950- 
51 (Fed. Cir. 1999). 

Specifically, applicant respectfuUy asserts that Col 5, lines 57-61 from Kephart merely 
discloses that "the user supplies either f a) a file containing a list of vims signatures to be evaluated or 
(b) one or mpre flies, each contaming one or more portions of mvariant viral code from which one or 
more virus signatures are to be extracted" (emphasis added). Clearly, Kephart's disclosure of using 
one or more portions of invariant vh^l code to extract virus signatures fails to even suggest a 
technique Vherein the anti computer virus logic identifies computer viruses prior to identifying the 
computer programs bann ed from use" (emphasis added), as claimed by applicant 

In addition, applicant respectfully asserts that Kephart discloses that "[i]n the evahjation 
mode the procedure starts with a given list of candidate signahires, one or more for each virus*' 
(emphasis added). Kephart furdier discloses that **the invention has been described above in the 
context of methods and apparatus for evaluating and exiractmg signatures of computer viruses and 
other undesirable software entities^' (Col, 18, Imes 1 7-^20 - emphasis added). However, Kephart's 
disclosure of using a list of candidate signatures in the evaluation mode for both computer viruses and 
other undesirable software entities teaches away from applicant's claimed technique '\vherein the anti 
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computer virus logic identifies computer viruses prior to identifying the computer program s hanne^ 
from ujg" (emphasis added), as claimed, since the same evaluation mode in Kephart is used for both 
computer viruses and othtt- undesirable software entities, without any indication of order. 

Thus, there is absolutely no evidence in the Kephart reference that makes it clear that such 
missing descriptive matter is necessarily present in the Kephart system, In fact, Ihere is even 
evidence to the contrary. In view of the arguments made hereinabove, any inherency argument has 
thus been adequately rebutted, and a notice of allowance or a specific prior art showing of such claim 
features, in combmation with the remaining claim elements is respectfully requested. (See MPEP 
2112) 

In the Office Action mailed 09/12/2006, the Examiner has argued that "since Kephait*s 
invention identifies both virus and non-virus (programs banned from use), it is an inherent feature of 
the Kephart invention, if run more than once, to identify a program bantied from use after identifying 
a virus " Further, the Examiner has argued that "even if on each pass through the signature list, the 
viruses were checked last, on the next running of the checker, the program will hove identified the 
banned programs after the previous identification of viruses." Applicant respectfully disagrees and 
asserts that Kephart merely discloses that **the invention has been described. . ,in the context of 
methods and apparatus for evaluating and extracting signatures of computer viruses and other 
undesirable software entities " (Col. 18, lines 17-20 - emphasis added). However, there is no 
indication fiom the cited excerpt that "on the next running of the checker, the program will have 
identified the banned programs after the previous identification of viruses^** as stated by the 
Examiner. 

Furthermore, the Examiner has generated a hypodietical situation that is simply not addressed 
in the Kephart reference, In response, applicant asserts that the feet that a oertahi result or 
characteristic may occur or be present in the prior art is not sufficient to establish the inherency of 
that result or characteristic. In re Rtjckaert, 9 F3d 1531, 1534, 28 USP(^2d 1955, 1957 (Fed. Cir. 
1993); In re OelricK 666 F.2d 578, 581-82, 212 USPQ 323. 326 (CCPA 1981). Thus, (t is not 
inherent in Kephart to ' 4dentif[v1 computer viruses prior to identifying the computer programs 
banned from use " (emphasis added), as claimed by applicant. 

In addition, in the Office Action mailed 9/12/2006, the Examiner has argued that "one of 
ordinary skill in the art would have been motivated to prioritize the identification of viruses before 
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identifying the computer programs banned from use because it is well known to identify the most 
severe threats first." First, it appears that, by incorporating an obviousness-type argument, the 
Examiner is fanproperly applying the prima facie case of obviousness in Ae context of a rejection 
under 35 U.S.C. 102(b). 

Further, applicant respectfully disagrees with such argument, and asserts that simply nowhere 
in Kephart is there any disclosure of differing degrees of severity between the identification of viruses 
and the identification of banned computer programs. To this end, the prior art does not even teach the 
problem solved by applicant. See Eibel Process Co. v Minnesota & Ontario Pc^er Co., 261 US 45 
(1923). 

Accordingly^ in order to establish a prima facie case of obviousness where the advance in the 
art lies in the discovery of the problem or source of the problem, as here, the Examiner must provide 
evidence that a person of ordinary skill in the art at the time of the present invention would have 
expected a problem to exist. As noted by the court in In Re Nomiya, 509 F.2d 566, 572, 1 84 USPQ 
607, 612 (CCPA 1975): 

[Where] there is no evidence of record that a person of ordinary skill in the art at the time of [an 
applicant's] invention would have expected [a problem^..., it is not proper to conclude that [an 
mvention], which solves tfiis problem.. , would have been obvious to that hypothetical person of 
ordinary skill in the art. The significance of evidence that a problem was known in the prior art is, of 
course, that knowledge of a problem provides a reason or motivation for workers in the art to apply 
their skfll to its solution. 

Absent such evidence in the record and a proper rejection under 35 U.S,C. 103(a), the rejection based 
on the Kephart reference cannot stand. 

Again, Kephart's mere disclosure of ^ Wuating and extracting signatures of computer 
viruses and other undesirable software ^nm^'' (Col. 18, lines 18-20 - emphasis added), in no way 
suggests or render obvious " identifTvingl computer vims&s prior to identifying the computer 
propyams t?anAed from use" (emphasis added), as claimed by appUcant. Therefore, in view of the 
arguments made hereinabove, any inherency argument has flius been adequately rebutted, and a 
notice of allowance or a specific prior art showing of such claim features, in combination with the 
remaining claim elements is respectfiilly requested, (See MPEP 2112) 
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The Examiner is reminded that a claim is anticipated only if each and every element as set 
forth in the claim is found, either expressly or inherently described in a single prior art reference. 
Verdegaal Bros. v. Union Oil Co. Of California, 814F.2d 628, 631, 2 USPQ2d 1051, 1053 (Fed. Cir. 
1987). Moreover, the identical invention must be shown in as complete detail as contained in the 
claim. Richardson v. Suzuki Motor Co. 868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). 
The elements must be arranged as requb-ed by the claim. 

The foregomg anticipation criterion has simply not been met by the above reference. 
Thus, a notice of allowance or specific prior art showmg of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectfully requested. 



Applicant further notes that the prior art is also deficient with respea to the dependent claims. 
For example, with respect to Claim 45, the Examiner has r«lied on Col. 5, lines 57-61 from the 
Kephart reference and an inherency argument to make a prior art showing of applicant's claimed 
technique "wherein the anti computer vims logic of a plurality of end users each includes a different 
selected set of computer programs banned from use." 

Applicant respectfully asserts tfiat the excerpt from Kephart relied upon by the Examiner to 
make the foregoing inherency argument merely discloses that "[i]n a first step, the user supplie.-; either 

containing a list of virus signatures to ha Av^l..af^ /f or (b) one or more files, each containing 
pne or more portions of invariant viral code (rt^m whirh »nA ^-prntrirc; rat to be 

extracted" (emphasis added). The Examiner has argued that "it is an inherent feature of Kephart that 
each end user anti computer vfrus logic includes a different selected set of computer programs (user- 
selected signatures) banned from use." Applicant respectfully disagrees, and asserts that Kephart 
merely discloses that the user suppUes "one or more files, each containmg one or more portions of 
invariant viral code." However, merely disclosing that the user may supply one or more files 
containing portions of invariant viral code fails to even suggest a technique "wherein the anti 
yomPHt^r virus logic of a plurality of end nsers gagh includes a different selected set of cf>mp nti>r 
programs banned from use" (emphasis added), as clahned by applicant. 

Further, with respect to Claim 46, die Examiner has rejected the same under 35 U.S.C. 103(a) 
as being unpatentable over Kephart in view of Golds et al. (U.S. Patent Publication 2001/0020245). 
Specifically, the Examiner has relied on Paragraphs O003, 0008, and 003 1 in Golds to make a prior 
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art showing of applicant's claimed technique 'Svherein an anti-virus scan is performed when a file 
access request is received, and if said anti-virus scan is not passed, an atiti-virus action is triggered 
and a fail response is returned to an operating system, and if said anti-virus scan is passed, a scan for 
the computer programs banned from use is performed," 



Applicant respectfully asserts that the excerpt from Golds relied upon by the Examiner 
merely discloses that "[sjoftware moduJes such as file svstem filter drivers may be stacked or 
otherwise arranged linearly (e.g.. chained^, and perform fheir operations in the order in which thev are 
Stacked" (emphasis added). Additionally, Golds discloses that "the drivers can intercept TRPs [(I/O 
request packets)], and modify, fetu^ and/or cancel them*' (emphasis added). However, the mere 
disclosure that file system fitter drivers may be arrangol linearly and that the drivers can intercept, 
modify, return, and/or cancel IRPs fails to even suggest a technique "wherein an anti-virus scan is 
performed when a file access request is received, and if said anti-vhois scan is not passed, an anti- 
virus action is triggered and a fail response is returned to an operating system, and if said anti-virus 
scan is passed ^ a scan for the computer p ograms banned from use is performed ^ (emphasis added), as 
claimed by applicant Clearly, the excerpts from Golds relied upon by the Examiner fell to even 
suggest that "if said anti-virus scan is passed, a scan for the computer pro-ams banned from use is 
performed" (emphasis added), as claimed by applicant. 

In addition, the Examiner has argued that "it is inherent in Kephart that all signatures will be 
scanned and therefore, if one signature does not match a file, the next will be checked." Applicant 
respectfijlly disagrees with the Examiner's inherency arguments. Applicant respectfully asserts that 
arguments made hereinabove with respect to the independent claims adequately rebut the inherency 
arguments made by the Examiner for applicant's claimed technique 'Vherein the anti computer virus 
•og^c identifies computer viruses prior to identifying the computer proia-ams banned from use " 
(emphasis added), let alone where "if said anti^virus scan is passed, a scan for the computer prog rams 
banned from use is performed" (emphasis added), as claimed by applicant. 

Again, the foregoing anticipation criterion has simply not been met by the above reference. 
Thus, a notice of allowance or specific prior art showing of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectftilly requested. 
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